From 810349517aaafe6370bf0eecc4f2f119c6c7316b Mon Sep 17 00:00:00 2001 From: Victor Barr Date: Wed, 21 Dec 2022 21:44:59 +0000 Subject: [PATCH] Add support for dba hal in common edgetpu packages Previously supported in some cases. Now extend it to all common cases Bug: 263394888 Test: Built and ran DBA Hal on Android Device Change-Id: I9a5c6a6c8d8b6c23a7d86678ecae57a9f0bcdf7a --- edgetpu/edgetpu.mk | 4 +++ edgetpu/sepolicy/edgetpu_dba_service.te | 38 +++++++++++++++++++++++++ edgetpu/sepolicy/file_contexts | 2 ++ edgetpu/sepolicy/priv_app.te | 1 - edgetpu/sepolicy/service.te | 1 + edgetpu/sepolicy/service_contexts | 3 ++ 6 files changed, 48 insertions(+), 1 deletion(-) create mode 100644 edgetpu/sepolicy/edgetpu_dba_service.te diff --git a/edgetpu/edgetpu.mk b/edgetpu/edgetpu.mk index 3f79438..7b93487 100644 --- a/edgetpu/edgetpu.mk +++ b/edgetpu/edgetpu.mk @@ -19,5 +19,9 @@ PRODUCT_PACKAGES += \ # TPU TFlite Delegate PRODUCT_PACKAGES += \ libedgetpu_util +# TPU DBA AIDL HAL service +PRODUCT_PACKAGES += com.google.edgetpu.dba-service +# TPU DBA C API library +PRODUCT_PACKAGES += libedgetpu_dba.google BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/edgetpu/sepolicy diff --git a/edgetpu/sepolicy/edgetpu_dba_service.te b/edgetpu/sepolicy/edgetpu_dba_service.te new file mode 100644 index 0000000..2e8f908 --- /dev/null +++ b/edgetpu/sepolicy/edgetpu_dba_service.te @@ -0,0 +1,38 @@ +# EdgeTPU DBA service. +type edgetpu_dba_server, domain; +type edgetpu_dba_server_exec, exec_type, vendor_file_type, file_type; +init_daemon_domain(edgetpu_dba_server) + +# The vendor service will use binder calls. +binder_use(edgetpu_dba_server); + +# The vendor service will serve a binder service. +binder_service(edgetpu_dba_server); + +# EdgeTPU DBA service to register the service to service_manager. +add_service(edgetpu_dba_server, edgetpu_dba_service); + +# Allow EdgeTPU DBA service to look for TPU instance in /dev/edgetpu or /dev/edgetpu-soc. +allow edgetpu_dba_server edgetpu_device:chr_file rw_file_perms; + +# Allow EdgeTPU DBA service to request power hints from the Power Service. +hal_client_domain(edgetpu_dba_server, hal_power) + +# Allow EdgeTPU DBA service to access hardware buffers and ION memory. +allow edgetpu_dba_server hal_allocator:fd use; +allow edgetpu_dba_server hal_graphics_mapper_hwservice:hwservice_manager find; +allow edgetpu_dba_server hal_graphics_allocator:fd use; +allow edgetpu_dba_server gpu_device:chr_file rw_file_perms; +allow edgetpu_dba_server gpu_device:dir r_dir_perms; +allow edgetpu_dba_server ion_device:chr_file r_file_perms; + +# Allow EdgeTPU DBA service to read the overcommit_memory info. +allow edgetpu_dba_server proc_overcommit_memory:file r_file_perms; + +# Allow EdgeTPU DBA service to read the kernel version. +# This is done inside the InitGoogle. +allow edgetpu_dba_server proc_version:file r_file_perms; + +# Allow EdgeTPU DBA service to send trace packets to Perfetto with SELinux enabled +# under userdebug builds. +userdebug_or_eng(`perfetto_producer(edgetpu_dba_server)') diff --git a/edgetpu/sepolicy/file_contexts b/edgetpu/sepolicy/file_contexts index e8fb9ac..8f6481c 100644 --- a/edgetpu/sepolicy/file_contexts +++ b/edgetpu/sepolicy/file_contexts @@ -22,3 +22,5 @@ /data/vendor/hal_neuralnetworks_darwinn(/.*)? u:object_r:hal_neuralnetworks_darwinn_data_file:s0 /data/vendor/edgetpu(/.*)? u:object_r:edgetpu_vendor_service_data_file:s0 +# EdgeTPU DBA service +/vendor/bin/hw/com\.google\.edgetpu.dba-service u:object_r:edgetpu_dba_server_exec:s0 diff --git a/edgetpu/sepolicy/priv_app.te b/edgetpu/sepolicy/priv_app.te index 22021a8..a9b49c3 100644 --- a/edgetpu/sepolicy/priv_app.te +++ b/edgetpu/sepolicy/priv_app.te @@ -7,4 +7,3 @@ allow priv_app edgetpu_nnapi_service:service_manager find; # Allows privileged applications to access the EdgeTPU device, except open, # which is guarded by the EdgeTPU service. allow priv_app edgetpu_device:chr_file { getattr read write ioctl map }; - diff --git a/edgetpu/sepolicy/service.te b/edgetpu/sepolicy/service.te index 3cb81dd..be06e04 100644 --- a/edgetpu/sepolicy/service.te +++ b/edgetpu/sepolicy/service.te @@ -1,5 +1,6 @@ type edgetpu_nnapi_service, app_api_service, service_manager_type; type edgetpu_vendor_service, service_manager_type, hal_service_type; +type edgetpu_dba_service, app_api_service, service_manager_type; # EdgeTPU binder service type declaration. type edgetpu_app_service, service_manager_type; diff --git a/edgetpu/sepolicy/service_contexts b/edgetpu/sepolicy/service_contexts index 9972eae..83967f7 100644 --- a/edgetpu/sepolicy/service_contexts +++ b/edgetpu/sepolicy/service_contexts @@ -5,3 +5,6 @@ android.hardware.neuralnetworks.IDevice/google-edgetpu u:object_r:edgetpu_nna # EdgeTPU service com.google.edgetpu.IEdgeTpuAppService/default u:object_r:edgetpu_app_service:s0 + +# EdgeTPU DBA Service +com.google.edgetpu.dba.IDevice/default u:object_r:edgetpu_dba_service:s0